mihari 4.1.0 → 4.2.0

data/lib/mihari/structs/ipinfo.rb

@@ -14,13 +14,12 @@ module Mihari
           include Mixins::AutonomousSystem
 
           def from_dynamic!(d)
+            d = d.deep_stringify_keys
             d = Types::Hash[d]
 
             asn = nil
             asn_ = d.dig("asn", "asn")
-            unless asn_.nil?
-              asn = normalize_asn(asn_)
-            end
+            asn = normalize_asn(asn_) unless asn_.nil?
 
             new(
               ip: d.fetch("ip"),

data/lib/mihari/structs/rule.rb

@@ -121,6 +121,36 @@ module Mihari
             data: data
           )
         end
+
+        #
+        # @return [Mihari::Analyzers::Rule]
+        #
+        def to_analyzer
+          analyzer = Mihari::Analyzers::Rule.new(
+            title: self[:title],
+            description: self[:description],
+            tags: self[:tags],
+            queries: self[:queries],
+            allowed_data_types: self[:allowed_data_types],
+            disallowed_data_values: self[:disallowed_data_values],
+            id: id
+          )
+          analyzer.ignore_old_artifacts = self[:ignore_old_artifacts]
+          analyzer.ignore_threshold = self[:ignore_threshold]
+
+          analyzer
+        end
+
+        class << self
+          #
+          # @param [Mihari::Rule] model
+          #
+          # @return [Mihari::Structs::Rule::Rule]
+          #
+          def from_model(model)
+            Structs::Rule::Rule.new(model.data)
+          end
+        end
       end
     end
   end

data/lib/mihari/structs/shodan.rb

@@ -26,9 +26,17 @@ module Mihari
 
         def self.from_dynamic!(d)
           d = Types::Hash[d]
+
+          # hostnames should be an array of string but sometimes Shodan returns a string
+          # e.g. "hostnames": "set(['149.28.146.131.vultr.com', 'rebs.ga'])",
+          # https://github.com/ninoseki/mihari/issues/424
+          # so use an empty array if hostnames is a string
+          hostnames = d.fetch("hostnames")
+          hostnames = [] if hostnames.is_a?(String)
+
           new(
             asn: d["asn"],
-            hostnames: d.fetch("hostnames"),
+            hostnames: hostnames,
             location: Location.from_dynamic!(d.fetch("location")),
             domains: d.fetch("domains"),
             ip_str: d.fetch("ip_str"),

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "4.1.0"
+  VERSION = "4.2.0"
 end

data/lib/mihari/web/api.rb

@@ -1,25 +1,5 @@
 # frozen_string_literal: true
 
-# Entities
-require "mihari/web/entities/message"
-
-require "mihari/web/entities/autonomous_system"
-require "mihari/web/entities/command"
-require "mihari/web/entities/config"
-require "mihari/web/entities/dns"
-require "mihari/web/entities/geolocation"
-require "mihari/web/entities/ip_address"
-require "mihari/web/entities/reverse_dns"
-require "mihari/web/entities/source"
-require "mihari/web/entities/tag"
-require "mihari/web/entities/whois"
-
-require "mihari/web/entities/artifact"
-
-require "mihari/web/entities/alert"
-
-require "mihari/web/entities/rule"
-
 # Endpoints
 require "mihari/web/endpoints/alerts"
 require "mihari/web/endpoints/artifacts"

data/lib/mihari/web/app.rb

@@ -6,12 +6,11 @@ require "rack/contrib"
 require "rack/handler/puma"
 require "rack/cors"
 
-require "grape"
-require "grape-entity"
 require "grape-swagger"
 require "grape-swagger-entity"
 
 require "mihari/web/middleware/connection_adapter"
+require "mihari/web/middleware/error_notification_adapter"
 
 require "mihari/web/api"
 
@@ -37,12 +36,13 @@ module Mihari
           end
 
           use Middleware::ConnectionAdapter
+          use Middleware::ErrorNotificationAdapter
 
           run App.new
         end.to_app
       end
 
-      def run!(port: 9292, host: "localhost", threads: "0:16", verbose: false)
+      def run!(port: 9292, host: "localhost", threads: "0:5", verbose: false)
         url = "http://#{host}:#{port}"
 
         Rack::Handler::Puma.run(instance, Port: port, Host: host, Threads: threads, Verbose: verbose) do |_launcher|

data/lib/mihari/web/endpoints/rules.rb

@@ -79,7 +79,9 @@ module Mihari
             error!({ message: "ID:#{id} is not found" }, 404)
           end
 
-          Mihari::CLI::Main.start ["search", rule.id]
+          struct = Mihari::Structs::Rule::Rule.from_model(rule)
+          analyzer = struct.to_analyzer
+          analyzer.run
 
           status 201
           present({ message: "ID:#{id} is ran successfully" }, with: Entities::Message)

data/lib/mihari/web/middleware/error_notification_adapter.rb

@@ -0,0 +1,19 @@
+module Mihari
+  module Middleware
+    class ErrorNotificationAdapter
+      include Mixins::ErrorNotification
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        with_error_notification do
+          status, headers, body = @app.call(env)
+
+          [status, headers, body]
+        end
+      end
+    end
+  end
+end

data/lib/mihari/web/public/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.cb1fa7be.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.cb1fa7be.js"></script></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="icon" href="/static/favicon.ico"/><title>Mihari</title><script defer="defer" type="module" src="/static/js/chunk-vendors.15e84e22.js"></script><script defer="defer" type="module" src="/static/js/app.4818aedd.js"></script><link href="/static/css/chunk-vendors.3ed9b08e.css" rel="stylesheet"><link href="/static/css/app.43138058.css" rel="stylesheet"><script defer="defer" src="/static/js/chunk-vendors-legacy.c99e452e.js" nomodule></script><script defer="defer" src="/static/js/app-legacy.46b666f0.js" nomodule></script></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div></body></html>